Security

Splunk behind reverse proxy keeps redirecting me to 127.0.0.1

Simon
Contributor

Hi all,

I've place splunkweb behind a reverse proxy and bound splunkweb and splunkd to 127.0.0.1.
The config:

splunk-launch.conf:

SPLUNK_BINDIP=127.0.0.1

web.conf:

[settings]
mgmtHostPort = 127.0.0.1:8189
httpport = 8100
tools.proxy.on = True
enableSplunkWebSSL = True

Apache's httpd.conf:

SSLProxyEngine On
ProxyPass /cgi-bin !
ProxyPass / https://127.0.0.1:8100/ retry=0
ProxyPassReverse / https://127.0.01:8100/ retry=0

When I now open splunk via the reverse proxy (https://mysplunksrv.domain.local), I get redirected to https://127.0.0.1:8100/de-DE/
Hitting directly https://mysplunksrv.domain.local/en-US/account/login opens the login page, after loggin in, I get redirected again to https://127.0.0.1:8100/de-DE/.

Any ideas?
Thx,
Simon

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive? But you also should put

ProxyPreserveHost On

in your Apache config.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive? But you also should put

ProxyPreserveHost On

in your Apache config.

View solution in original post

Simon
Contributor

Oh god... how embarassing. The typo was the key. Thanks for pointing it out!

gkanapathy
Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive?

0 Karma

jbouch03
Path Finder

Have you tried using the actual IP of the Splunk system in the Splunk binding? I haven't tried this on my setup, but it looks like the redirect is caused by the Splunk binding. Try using the actual IP of the system and see if it fixes the issue.

0 Karma

Simon
Contributor

I only want to access splunk via web proxy, which is bound to the actual ip. Splunk should not listen to any non-local interface. But it works now, it was a typo (see below)

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!